![](bgc.png)
REFERENCES
Alves, H., Fonseca, B., and Antunes, N. (2016). Software
metrics and security vulnerabilities: Dataset and ex-
ploratory study. In EDCC 2016, pages 37–44.
Barnett, J. G., Gathuru, C. K., Soldano, L. S., and McIn-
tosh, S. (2016). The relationship between commit
message detail and defect proneness in Java projects
on GitHub. In 13th MSR, pages 496–499.
Chang, Y.-Y., Zavarsky, P., Ruhl, R., and Lindskog, D.
(2011). Trend analysis of the CVE for software vul-
nerability management. In IEEE PST, pages 1290–
1293.
Du, X., Chen, B., Li, Y., Guo, J., Zhou, Y., Liu, Y., and
Jiang, Y. (2019). Leopard: identifying vulnerable
code for vulnerability assessment through program
metrics. In ICSE, pages 60–71.
Gkortzis, A., Mitropoulos, D., and Spinellis, D. (2018).
Vulinoss: a dataset of security vulnerabilities in open-
source systems. In MSR, pages 18–21. ACM.
Han, H., Oh, D., and Cha, S. (2019). CodeAlchemist:
Semantics-aware code generation to find vulnerabil-
ities in JavaScript engines. In NDSS.
Holler, C., Herzig, K., and Zeller, A. (2012). Fuzzing with
code fragments. In USENIX, pages 445–458.
Iannone, E., Guadagni, R., Ferrucci, F., Lucia, A. D., and
Palomba, F. (2022). The secret life of software vulner-
abilities: A large-scale empirical study. TSE, (01):1–1.
Jimenez, M., Rwemalika, R., Papadakis, M., Sarro, F.,
Traon, Y. L., and Harman, M. (2019). The importance
of accounting for real-world labelling when predict-
ing software vulnerabilities. In ESEC/SIGSOFT FSE
2019, pages 695–705. ACM.
Kang, Z. (2021). A review on JavaScript engine vulnera-
bility mining. Journal of Physics: Conference Series,
1744(4):042197.
Kiss, A. and Hodov
´
an, R. (2019). Security-related commits
in open source web browser projects. In ASEW, pages
57–60.
Kitchenham, B., Madeyski, L., Budgen, D., Keung, J., Br-
ereton, P., Charters, S., Gibbs, S., and Pohthong, A.
(2017). Robust statistical methods for empirical soft-
ware engineering. Empir. Softw. Eng., 22(2).
Lee, S., Han, H., Cha, S. K., and Son, S. (2020). Montage:
A neural network language Model-Guided JavaScript
engine fuzzer. In USENIX Security 20, pages 2613–
2630. USENIX Association.
Lin, H., Zhu, J., Peng, J., and Zhu, D. (2019). Deity: Find-
ing deep rooted bugs in JavaScript engines. In 2019
ICCT, pages 1585–1594.
Mao, J., Bian, J., Bai, G., Wang, R., Chen, Y., Xiao, Y.,
and Liang, Z. (2018). Detecting malicious behaviors
in JavaScript applications. IEEE Access, 6:12284–
12294.
Medeiros, N., Ivaki, N., Costa, P., and Vieira, M. (2017).
Software metrics as indicators of security vulnerabili-
ties. In ISSRE, pages 216–227.
MITRE (2023). Common Weakness Enumeration. https:
//mitre.org/.
Neuhaus, S. and Zimmermann, T. (2010). Security trend
analysis with CVE topic models. In ISSRE, pages
111–120.
OffensiveCon (2022). Attacking JavaScript Engines in
2022. https://www.offensivecon.org/speakers/20
22/samuel-gro-and-amanda-burnett.html.
Park, S., Xu, W., Yun, I., Jang, D., and Kim, T. (2020).
Fuzzing JavaScript engines with aspect-preserving
mutation. In IEEE S&P, pages 1629–1642.
Pedregosa, F., Varoquaux, G., Gramfort, A., Michel, V.,
Thirion, B., Grisel, O., Blondel, M., Prettenhofer, P.,
Weiss, R., Dubourg, V., Vanderplas, J., Passos, A.,
Cournapeau, D., Brucher, M., Perrot, M., and
´
Edouard
Duchesnay (2011). Scikit-learn: Machine learning in
Python. J. Mach. Learn. Res., 12(85):2825–2830.
Shin, Y., Meneely, A., Williams, L. A., and Osborne, J. A.
(2011). Evaluating complexity, code churn, and de-
veloper activity metrics as indicators of software vul-
nerabilities. TSE, 37(6):772–787.
Shin, Y. and Williams, L. (2008). An empirical model to
predict security vulnerabilities using code complexity
metrics. In ESME, ESEM ’08, page 315–317.
Shin, Y. and Williams, L. (2011). An initial study on the
use of execution complexity metrics as indicators of
software vulnerabilities. In SESS, page 1–7.
Spadini, D., Aniche, M., and Bacchelli, A. (2018). Py-
Driller: Python framework for mining software repos-
itories. In ESEC/FSE, pages 908–911.
SSLAB (2021). Analysis of a use-after-unmap vulnerability
in Edge: CVE-2019-0609 - Systems Software and Se-
curity La. https://gts3.org/2019/cve-2019-0609.html.
Sun, L., Wu, C., Wang, Z., Kang, Y., and Tang, B. (2022).
Kop-fuzzer: A key-operation-based fuzzer for type
confusion bugs in javascript engines. In COMPSAC,
pages 757–766.
US-Government (2023). National Vulnerability Database.
https://nvd.nist.gov/.
Wang, B., Yan, M., Liu, Z., Xu, L., Xia, X., Zhang, X.,
and Yang, D. (2021). Quality assurance for automated
commit message generation. In SANER, pages 260–
271.
Zaman, S., Adams, B., and Hassan, A. E. (2011). Security
versus performance bugs: a case study on Firefox. In
MSR, pages 93–102. ACM.
Zhang, Y., Jin, R., and Zhou, Z. (2010). Understanding bag-
of-words model: a statistical framework. Int. J. Mach.
Learn. Cybern., 1:43–52.
Zhou, A., Sultana, K. Z., and Samanthula, B. K. (2021). In-
vestigating the changes in software metrics after vul-
nerability is fixed. In IEEE Big Data, pages 5658–
5663.
Characterizing Security-Related Commits of JavaScript Engines
97